From owner-freebsd-net@FreeBSD.ORG  Tue May  9 21:14:04 2006
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
X-Original-To: freebsd-net@freebsd.org
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 4E35A16A527
	for <freebsd-net@freebsd.org>; Tue,  9 May 2006 21:14:04 +0000 (UTC)
	(envelope-from thompsa@freebsd.org)
Received: from heff.fud.org.nz (203-109-251-39.static.bliink.ihug.co.nz
	[203.109.251.39])
	by mx1.FreeBSD.org (Postfix) with SMTP id 6C18D43D4C
	for <freebsd-net@freebsd.org>; Tue,  9 May 2006 21:14:03 +0000 (GMT)
	(envelope-from thompsa@freebsd.org)
Received: by heff.fud.org.nz (Postfix, from userid 1001)
	id 436571CCC1; Wed, 10 May 2006 09:13:57 +1200 (NZST)
Date: Wed, 10 May 2006 09:13:57 +1200
From: Andrew Thompson <thompsa@freebsd.org>
To: freebsd-net@freebsd.org
Message-ID: <20060509211357.GA939@heff.fud.org.nz>
References: <4460FF4E.10305@ifi.unicamp.br>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <4460FF4E.10305@ifi.unicamp.br>
User-Agent: Mutt/1.5.11
Subject: Re: ipfw divert with layer2 (if_bridge) packets
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 09 May 2006 21:14:05 -0000

On Tue, May 09, 2006 at 05:45:02PM -0300, Carlos E Gaspar wrote:
> Hi.
> 
> I have the following setup:
> 
> FreeBSD abc5.5-PRERELEASE FreeBSD 5.5-PRERELEASE #0: Wed Apr 26 14:58:22 
> BRT 2006     root@abc:/usr/src/sys/alpha/compile/ABC alpha
> 
> bridge0: flags=8043<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
>        ether xx:xx:xx:xx:xx:xx
>        priority 32768 hellotime 2 fwddelay 15 maxage 20
>        member: de1 flags=3<LEARNING,DISCOVER>
>        member: de0 flags=3<LEARNING,DISCOVER>
> 
> de1 is my internal interface (local) and de0 the external (internet). 
> host1 is on de1. Bridge works fine (if_bridge).
> 
> With the following sysctl's:
> 
> net.link.bridge.pfil_onlyip: 0
> net.link.bridge.pfil_member: 1
> net.link.bridge.pfil_bridge: 0
> net.link.bridge.ipfw: 0
                  ^^^^^^^

This should be 1. 

 net.link.bridge.ipfw   Set to 1 to enable layer2 filtering with
                        ipfirewall(4), set to 0 to disable it.  This
                        needs to be enabled for dummynet(4) support.
                        When ipfw is enabled, pfil_bridge and
                        pfil_member will be disabled so that IPFW is
                        not run twice; these can be re-enabled if
                        desired.


Give that a try.

cheers,
Andrew